Do we need to hide the google oauth client id? -
everyone. i'm learning oauth authentication. i'm playing around google's oauth api. in tutorial google sign-in server-side apps, in third step - initialize googleauth object, need provide client id initialize googleauth object. i'm wondering if need keep client id secret because right can find out client id looking javascript.
you don't need hide client id, provided restricted access specific javascript origins , redirect uri's on server side. see more details on this quora thread or this ietf thread.
Comments
Post a Comment